CONFLUX TECHNICAL PRESENTATION · 2020. 3. 9. · TECHNICAL PRESENTATION By Conflux in 2020. X-RG 2 Table of Contents Conflux Main Ideas & Architecture 2.Conflux Algorithm: Design

CONFLUXTECHNICAL PRESENTATION

By Conflux in 2020

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

2

Table of Contents

Conflux Main Ideas & Architecture

2. Conflux Algorithm: Design & Explanation

3. Safety against Double Spending Attacks

4. Robustness against Liveness Attacks

5. Challenges and Solutions on System Level

1. One Observation of Blockchain Consensus

6. Evaluation of Conflux

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

3

Conflux Main Ideas

- Organize blocks as a novel consensus algorithm

- Extend the consensus of a chain to the consensus of a total order of all blocks in the Conflux Algorithm

Blockchain transactions rarely conflict

Conflux exploits this to optimistically process concurrent blocks:

Conflux achieves thousands of transactions per seconds and < 30 seconds confirmation time with confidence as 6 blocks in Bitcoin

The bottleneck of performance is no longer at the consensus layer!

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

4

Conflux Architecture

Blocks are organized in Conflux Algorithm state instead of chain state

Consensus on the total order of all blocks guaranteed by Conflux Algorithm

Each miner runs block generator to pack and valid new blocks

Miners and users propagate transactions via gossip network

Each miner maintains a pool of pending transactions

ConfluxONE OBSERVATION OF BLOCKCHAIN CONSENSUS

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

6

One Observation (1/2) Bitcoin Does not Support Concurrent BlocksBitcoin enforces a very restrictive transaction total order at the generation time of each block:

Block1… Block0

Block2

Block1: My transactions need to follow Block0!

Block2: My transactions need to follow Block0!

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

7

One Observation (2/2) Bitcoin does not Support Concurrent Blocks

… Block0

Block2 Block3 Block4 Block5

Case2: Block2 survives and its order becomes the final transaction history, Block1 is discarded!

Block1… Block0

Block2

Block3 Block4 Block5

Case1: Block1 survives and its order becomes the final transaction history, Block2 is discarded!

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

8

Blockchain Transactions Rarely Conflict How to Improve the Efficiency of Transactions?

Block1… Block0

Block2

Conflux organizes blocks in a Tree Graph (Conflux Algorithm)

Blockchain transactions rarely conflict with each other and they can be serialized in any order

Why not processing non-conflicting transactions in concurrent blocks?

ConfluxCONFLUX ALGORITHM: DESIGN & EXPLANATION

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

10

How to Determine the Total Order of all Blocks in Conflux Algorithm（1/3）

Each block has one outgoing parent edge to its parent blockparent edges would form a tree structure

Genesis

Tx0Tx1

A

Tx2

B

Tx3Tx4

GTx4

C

D

E

F

H

J I K

Parent edgesTx0: Mint 10 coins to X

Tx1: Mint 10 coins to Y

Tx2: X sends 8 to Y

Tx3: X sends 8 to Z

Tx4: Y sends 8 to Z

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G


Tx0: Mint 10 coins to X


Tx2: X sends 8 to Y

Tx3: X sends 8 to Z

Tx4: Y sends 8 to Z

Parent edges

Each block may have multiple ref. edges, Ref. edges simply indicate the “happen-before” relationships

Ref. edgesE admits that D is generated before E

Genesis

Tx0Tx1

A

Tx2

B

Tx3Tx4

GTx4

C

D

E

F

H

J I K

11

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G


Step 1 Determine a pivot chain of blocks based on parent edges,those blocks are partially ordered

Step 2 Extend the pivot chain partial order to a total order of all blocks based on the ref. edges

Deterministically define the total order of blocks in Conflux



Tx2: X sends 8 to Y

Tx3: X sends 8 to Z

Tx4: Y sends 8 to Z

Parent edgesRef. edges

Genesis

Tx0Tx1

A

Tx2

B

Tx3Tx4

GTx4

C

D

E

F

H

J I K

12

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Consensus of the Pivot Chain in Conflux

1. Start from the Genesis block

2. Iteratively advance to the heaviest branch – heterogeneous block weight by GHAST rule

Pivot chain selection by modified GHOST Rule [Sompolinsky et. al., ICFCDS’15]:

GenesisTx0Tx1

ATx2

BTx3Tx4

GTx4

C

D

E

F

H

J I K

Subtree A has 6 nodes

Subtree B has 5 nodes



Tx2: X sends 8 to Y

Tx3: X sends 8 to Z

Tx4: Y sends 8 to Z

Ref. edgesParent edges

Why not applying the longest chain rule to select the Conflux pivot chain?

Even forked blocks are counted in the selection of every branch, which guarantees that the attacker always need >50% power to revert the pivot chain.

13

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

How to Compose a New Block in Conflux?



Tx2: X sends 8 to Y

Tx3: X sends 8 to Z

Tx4: Y sends 8 to Z


GenesisTx0Tx1

ATx2

BTx3Tx4

GTx4

C

D

E

F

H

J I K

New Block

Why both kinds of edges are necessary?

Indeed, the parent edge can be computed even if there is only one kind of ref. edges. However, explicit listing all parent edges allows a much more efficient implementation of Conflux Algorithm.

Step 1 Select the last block in the pivot chain as parent

Step 2 Create reference edges to all other unreferenced blocks, e.g. blocks without any incoming edge

Rules for generating a new block:

14

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Extending Partial Order to Total Order of All Blocks（1/2）The rules of partitioning blocks into epochs:

D belongs to the epoch of E, because D happens before E but does not happen before C



Tx2: X sends 8 to Y

Tx3: X sends 8 to Z

Tx4: Y sends 8 to Z


GenesisTx0Tx1

ATx2

BTx3Tx4

GTx4

C

D

E

F

H

J I K

Epoch of Genesis Epoch of A Epoch of C Epoch of E Epoch of H

1. Each pivot chain block forms one epoch

2. Every non-pivot block belongs to the first epoch whose pivot block admits to be generated after it

15

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Extending Partial Order to Total Order of All Blocks（2/2）The rules of ordering all blocks with respect to their epochs :

1. Order based on epoch first – blocks in earlier epochs always precede blocks in later epochs

2. Topologically sort blocks inside each epoch, according to the “happen-before” relations

3. Break ties deterministically based on Block ID

Block Total Order: Genesis, A, B, C, D, F, E, G, J, I, H, KTx0: Mint 10 coins to X


Tx2: X sends 8 to Y

Tx3: X sends 8 to Z

Tx4: Y sends 8 to Z


GenesisTx0Tx1

ATx2

BTx3Tx4

GTx4

C

D

E

F

H

J I K


16

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Total Order of Blocks to Total Order of TransactionsTotal order of blocks ⇒ total order of transactionsOnly need to discard conflict and duplicate transactions



Tx2: X sends 8 to Y

Tx3: X sends 8 to Z

Tx4: Y sends 8 to Z


Genesis, A, B, C, D, F, E, G, J, I, H, K

Tx0, Tx1, Tx2, Tx3, Tx4, Tx4

Conflict Duplicate

GenesisTx0Tx1

ATx2

BTx3Tx4

GTx4

C

D

E

F

H

J I K

Epoch of A Epoch of C Epoch of E Epoch of H

17

ConfluxSAFETY AGAINST DOUBLE SPENDING ATTACKS

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Why Conflux is Safe Against Double Spending Attacks

Claim1: an attacker cannot revert a transaction unless he/she reverts the Pivot Chain

Claim2:an attacker cannot revert the Pivot Chain unless he/she controls 50% block generation power

NecessaryCondition

NecessaryCondition

Succeeding in Double Spending Attack

Revertingthe Pivot Chain

More than 50% malicious block generation power

19

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Claim 1: an Attacker Cannot Revert a Transaction without Reverting the Pivot Chain (1/2)



Tx2: X sends 8 to Y

Tx3: X sends 8 to Z

Tx4: Y sends 8 to Z


In order to double spend Tx2 (in block A), an attacker may refer the genesis block as parent and expects that the malicious block (Attack A) precedes A in the total order

How could an attacker possibly revert Tx2?

GenesisTx0Tx1

ATx2

BTx3Tx4

GTx4

C

D

E

F

H

J I K


Attack A

20

Genesis, A, B, C, D, F, E, G, J, I, H, K

Attacker’s Block

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Claim 1: an Attacker Cannot Revert a Transaction without Reverting the Pivot Chain (2/2)However, as long as the pivot chain is not reverted, the malicious block (Attack A) must belong to a later epoch; so that the attacker cannot double spend Tx2



Tx2: X sends 8 to Y

Tx3: X sends 8 to Z

Tx4: Y sends 8 to Z


GenesisTx0Tx1

ATx2

BTx3Tx4

GTx4

C

D

E

F

H

J I K


New Block

Attack A

Epoch of New Block

As long as Attack B does not get on the pivot chain, it belongs to a very late epoch

21

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Claim 2: an Attacker Cannot Revert the Pivot Chain unless he/she Controls 50% Block Generation Power

…

A

A’ Subtree of A’

Blocks from honest participants

Blocks from the attacker

Subtree of A

How to revert an old block:

Suppose to revert a pivot chain block A

Honest participants may create small forks but always under the subtree of A

Attacker needs at least 50% block generation power to make subtree of A’ heavier than A

22

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Why 50% Power is Necessary to Revert the Pivot Chain

Chance of A’ outgrowing A after time t is less than:

…A Subtree of A

A’ Subtree of A’

A has 𝑛 blocks at time 𝑡 − 𝑑

A’ has 𝑚 blocks at time 𝑡

𝑞 (𝑞 < 1) is the ratio of the attacker’s block generation power comparing to honest participants

𝑑 is the network delay

23𝜆- is the block generation rate ofhonest participants.

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Conflux Confirmation Rules

- The power of attacker – 𝑞- The tolerable risk of a transaction being reverted -- 𝑟

Conflux’s confirmation is designed base on extensive precise safety analysis

User specifies the security parameter:

Find the epoch where the transaction is first processed

Find the pivot chain block of the epoch

Check whether the overall risk of some previous pivot chain block being reverted is tolerable

24

ConfluxROBUSTNESS AGAINSTLIVENESS ATTACKS

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Why GHOST Rule is Vulnerable under Liveness Attacks

- The attacker controls network delay and has little block generation power

- Honest participants are partitioned into two comparable groups with significant delay in between

- The attacker will be able to balance the weight of two branches A and B such that no block can be confirmed forever!

G

A

Honest Group A

Honest Group B

Maximum delay of d

AttackerA AttackerA

AttackerB AttackerB

A A A A A A

B B B B B B B

26

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

GHAST – Greedy Heaviest Adaptive SubTree（1/3）

- no attack: low difficulty blocks ⇒ fast confirmation (<1 min)

- active attack: high difficulty blocks ⇒ fast recovery (≤30 min)

Adaptive block weight for tradeoffs between performance and safety

Consensus throughput uninfluenced in both cases

27

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

GHAST – Greedy Heaviest Adaptive SubTree（2/3）The block weight is adaptively determined by its past :

1. Weight is 1 in the normal case

2. Weight is adapted in case there is an observable liveness attack

• All honest participants will agree on the heterogenous weights

• Even in the presence of attackers!

Is the past sub-graph stable enough?

• Yes: Assign weight 1

• No: Assign weight ℎ for1/ℎ blocks, while other blocks have 0 weight

28

29

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

GHAST – Greedy Heaviest Adaptive SubTree（3/3）For example

1. H observes two-subtrees with balanced weight

2. H has high weight if it has a much harder PoW quality (e.g. h times of usual difficulty), and it has zero weight otherwise

GenesisTx0Tx1

ATx2

BTx3Tx4

GTx4

C

D

E

F

H

J I



ConfluxCHALLENGES AND SOLUTIONS ON SYSTEM LEVEL

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

How to Store the Transactions under a High TPS.

31

B B B B B B B B……

Recent blocksBlocks earlier than 1 month ago

Note: To make the figure clear, we skim the non-pivot block here.

Light nodes(For clients)

Full nodes(For consensus)

Archive nodes(For storage)

Only store block headers Only store block headers

Only store block headers Store transactions and ledger states

Store transactions and ledgerstates

Store transactions and ledger states

Bitcoin has <7TPS and accumulates <300 GB data in ten years. However, Conflux has >3000 TPS, how to store thetransaction data?

We use archive nodes specially for storing data. Full nodes store the header for all blocks so they can check the correctness of data from archive nodes.

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Decoupling Consensus Protocol with Transaction Execution

32

In Ethereum, when an honest node received a new block, it needs to execute the transaction in this block and checkthe validity of state root before appending it to the blockchain.

However, such solution incurs a large amount of computation tasks in a blockchain protocol with a high generationrate like Conflux.

We decouple the consensus protocol with a transaction execution. When an honest node received a new block, itdoesn’t care about the validity of the state root before incorporating it into tree-graph structure.

A block in pivot chain may contain an incorrect state root. We propose blaming mechanism to handle it.

The tail of pivot chain may change frequently, so we propose deferred execution.

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Blaming Mechanism (1)

33

A

A is a malicious block.A contains incorrectstate root.

B

B is a child of AB is an honest block.B blames A because ithas incorrect state root.

D

D is a malicious block.D contains incorrect stateroot.

E

E is a child of DE is a malicious block.E doesn’t blame D.E contains correct state root

C is a child of BC is an honest block.C doesn’t blame B and agreewith B’s opinion (A is wrong).

C

F

F is a child of EF is an honest block.F blames E and D because Dhas incorrect state root and Edoesn’t blame D.

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Blaming Mechanism (2)

34

B

By blaming mechanism, each block receives votes from its subtree blocks. And we can decide the correctness of block B.

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Deferred Execution (1)

35

StateRoot

StateRoot

TX1

TX2

Order1: TX1, TX2

- Parity Merkle-Tree db throughput about 3000 tps

Execution budget is very tight

Storage access could potentially be next bottleneck

- The tail of pivot chain may change frequently and thus change the block order.

- Naïve state root maintenance leads to dup execution

Pivot chain needs time to converge

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G


36Order2: TX1, TX3, TX2, TX4

Order1: TX1, TX2

TX2 executes twice!

- Parity Merkle-Tree db throughput about 3000 tps

Execution budget is very tight

Storage access could potentially be next bottleneck

- The tail of pivot chain may change frequently and thus change the block order.

- Naïve state root maintenance leads to dup execution

Pivot chain needs time to converge

StateRoot

TX1

StateRoot

TX3

StateRoot

TX2

StateRoot

TX4

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G


37

TX2 only executes once atthe time receiving C.

K-deferred execution only executes to generate state root when pivot block will probably not change

A

Defer-Root

TX1

B

Root of A

TX3

E

Root of A

TX2

C

Root of B

TX4

D

Root of C

TX5

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Reduce Bandwidth Overhead in Transaction Dissemination (1)

38

TX1

A full node

A transaction(100 Byte)

It is redundant to push the same transaction to one node multiple times.

TX1

TX1

TX1 TX1

TX1

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G


39

Push hash value instead of the whole transaction, and let the receiver requests the transaction in needed.But it still costs too much bandwidth.

ID1

A full node

Hash value ofthe transaction(32 Byte)

TX1A transaction(100 Byte)

TX1

TX1

TX1 TX1

TX1

ID1

ID1

ID1ID1

ID1

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G


40

A shorter hash value may be helpful. But two different transactions may have the same short id. So the receiver falsely thinks it has received tx2.

SID1

A full node

Short Hash valueof the transaction(4 Byte)


and

have the same short

hash value

TX1 TX2

SID1

TX1

TX1

TX1 TX1

TX2

TX2

SID1

SID1

SID1SID1

SID1

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G


41

Let each node share a random seed s with each peer.Each node not only sends short hash value SID1, but also computes a random byte R from tx and s.So the receiver will not loss transactions even if two transactions have the same short hash value.

SID1

Random byteof the transaction(1 Byte)

Short Hash valueof the transaction(3 Byte)


A full node

RTX1

TX1

TX1 TX1

TX2

R R

R

R

TX2 R

SID1

SID1SID1

SID1

SID1

TX2

ConfluxEVALUATION OFCONFLUX

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Environment and Objective of Experiments

12k full nodes on Amazon EC2

Each full node with bandwidth limited to 20Mbps

Different configurations (block size/block interval/etc.)

Throughput, confirmation latency and network delay

43

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Globally Distributed Experimental Nodes

44

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

High Consensus Throughput – New Achievements !

• 300 KB block / 0.25s

• 4.2 GB/h (9.38 Mbps)

• 4700 TPS in theory

Conflux achieves consensus throughput at:

• Bitcoin: 6 MB/h (12 MB/h with SegWit2x), 3~7 TPS

• Ethereum: 20~30 MB/h, ~20 TPS

• Algorand: 750 MB/h, 1000 TPS

Consensus throughput of other mainstream projects:

- comparable experimental environment (10k nodes)

45

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Nearly Optimal Confirmation Time

Confirmation latencyless than 1 minute with high confidence(equivalent to 6 blocks in BTC)

Best performanceover all PoW-basedconsensus systems

46

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Beyond High Consensus Throughput

- new implementation of Merkle Patricia Tree

- Tree-Graph structured with Link-Cut Trees

- Deferred Execution

New techniques for extreme end-to-end efficiency

1392 TPS (Historical Ethereum transactions with contracts and dependency)

3480 TPS (14% Ethereum transactions + 86% Random transactions)

47

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Defending Liveness Attacks with GHAST80-page rigorous mathematical proof of safety and liveness

Detecting and resolving liveness attacks within half an hour

- even less than the normal confirmation time of Bitcoin

48

WW

W.C

ON

FL

UX

-CH

AIN

.OR

G

Related Works

Resolve tx. conflicts at block generation:

Decentralized Reduced Participation

Bitcoin, Ethereum

Algorand[SOSP’17] BitcoinNG

[NSDI’16]Hybrid Consensus

[Pass and Shi], Byzcoin [USENIX

Sec’16]

Stellar

PBFT [OSDI’99]Libra

HoneyBagger[CCS’16]

Optimistically process blocks; lazily resolve tx. conflicts:

Conflux

Conflux exploits the fact that the blockchain transactions rarely conflict with

each other.

49

THANKS!www.conflux-chain.org

Documents

CONFLUX TECHNICAL PRESENTATION · 2020. 3. 9. · TECHNICAL PRESENTATION By Conflux in 2020. X-RG 2 Table of Contents Conflux Main Ideas & Architecture 2.Conflux Algorithm: Design